For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Advanced Threat Mitigations via SSL Intercept

SSL offload has been around for quite some time. But this technology was primarily developed for the web farm audience, offloading SSL traffic from the application servers and putting the load on app...
Published Feb 23, 2016
Version 1.0
AFM
dcsecurity16
fireeye
security
ssl
TMOS
JRahm's avatar
Icon for Admin rankAdmin
Christ Follower, Husband, Father, Technologist. I love community and I especially love THIS community. My background is networking, but I've dabbled in all the F5 iStuff, I'm a recovering Perl guy, and am very much a python enthusiast. Learning alongside all of you in this accelerating industry toward modern apps and architectures.
View Profile
JRahm's avatar
Icon for Admin rankAdmin
Christ Follower, Husband, Father, Technologist. I love community and I especially love THIS community. My background is networking, but I've dabbled in all the F5 iStuff, I'm a recovering Perl guy, and am very much a python enthusiast. Learning alongside all of you in this accelerating industry toward modern apps and architectures.
View Profile
JRahm's avatar
JRahm
Icon for Admin rankAdmin
Jul 27, 2017

the mechanics are simple, insert/replace of each valid Public-Key-Pinning header is supposed to clear out the old entries and set it to the values in the latest response. See section 2.3.1 of the RFC.

 

that said, hpkp is complex and can brick a domain, so tread lightly and -report-only with much validation before pulling the trigger!